Path Traversal in SWE-agent Trajectory Inspector

SWE-agent version 1.1.0 includes a trajectory inspector component that functions as an HTTP server. This server fails to properly sanitize user-supplied paths in the /trajectory/ handler, allowing the use of path traversal ('..') sequences to bypass restrictions. The application binds to all network interfaces (0.0.0.0) by default and enforces no authentication, exposing it to remote unauthenticated attackers. Additionally, the service implements permissive wildcard CORS headers, which can facilitate cross-site attacks where a malicious web page makes unauthorized requests on behalf of a user. The vulnerability allows an attacker to retrieve arbitrary files from the filesystem, provided the target files are formatted as JSON, as the application logic attempts to parse retrieved data as trajectory files. This represents a significant risk for the disclosure of sensitive information, including repository metadata, command output, and API keys stored in JSON format.

Impact

Successful exploitation allows for the unauthorized retrieval of JSON-formatted sensitive data from systems running the sweagent inspector. This includes secrets, API keys, and repository source code, potentially leading to downstream compromise of developer environments or CI/CD pipelines.

Recommendation

1. Upgrade the SWE-agent installation to a version where path traversal in the /trajectory/ handler is remediated.
2. Restrict network access to the sweagent inspector to authorized local interfaces or behind a reverse proxy that enforces authentication.
3. Deploy the provided web server detection logic to identify and block path traversal attempts directed at the /trajectory/ URI.